Privacy Rights vs. Public Safety Concerns: HHS Proposes HIPAA Change

One of the greatest concerns with the protections afforded by HIPAA is how to balance the strict confidentiality of protected health information (PHI) with the arguable advantage of disclosing certain information that could protect the public. This debate often is prominent in the wake of a mass-shooting where it is learned that the gunman had serious mental health issues previously unknown to those around him or law enforcement.

Perhaps taking this into consideration, HHS published notice of a proposed rule making to modify HIPAA to expressly permit (but not require) certain entities to disclose otherwise confidential PHI to the National Instant Criminal Background Check System (NICS) without authorization of the person whose PHI would be disclosed. The proposed information to be disclosed would identify individuals subject to a federal “mental health prohibitor” that would disqualify them from shipping, transporting, possessing, or receiving a firearm.

Individuals who have been committed involuntarily to a mental institution, found incompetent to stand trial, or found not guilty by reason of insanity are among those who are subject to a prohibitor. This list also would include those persons who have been determined by a court, board, commission, or other lawful authority to be a danger to themselves or others or who lack the mental capacity to contract or manage their own affairs. Additionally, individuals with marked subnormal intelligence or mental illness, incompetency or serious mental condition or disease also would fall under this category.

Under the proposed rule, certain HIPAA covered entities will be able to disclose limited information (not medical records or clinical information) directly to NICS indicating that the individual is subject to a prohibitor. The covered entities subject to this narrow HIPAA exception include only those entities that are designated by the state to report or collect information for NICS, those entities with the authority to make adjudications or commitment decisions that make an individual subject to a prohibitor, or those entities that serve as repositories of information for NICS reporting purposes.

HHS asserts that the proposed rule is trying to strike a balance between the individual privacy protections of HIPAA and public policy considerations. Such public policy considerations include protecting the public by identifying those persons who reasonably may present a safety issue. Further, this rule is intended to address the perception that HIPAA creates certain barriers to entities reporting information to NICS.

It remains to be seen, however, if this proposed rule will be implemented and, if so, if it will have any impact on the perceived proliferation of gun violence related to mental health issues.